Overview

overview

10

Static

static

1

c3aaf13e00...e9.exe

windows7-x64

10

c3aaf13e00...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3aaf13e00b2fa20b47d40d2a3a761e9

  • Size

    2.9MB

  • Sample

    231228-e64k8aacen

  • MD5

    c3aaf13e00b2fa20b47d40d2a3a761e9

  • SHA1

    a5e6edb17f2fb8b3818e70475aa644ca1589e672

  • SHA256

    e4e17547eda5ad55ec2da710928f2c766c369ef5612f73a18d5049d53dd882f4

  • SHA512

    48e9fd927ded8b2b855ac2628a05154e9fac264c1cc450ed3be33d45ca5449f17a57e81f2d8fa89cbcabf61171c1f9b53619aa9484b31ba97ed78a5f273cafbd

  • SSDEEP

    49152:CrR+n6HfwpFlN8V6Mkcj12PF1XmtBALZQynwu576ZtTBPo54:0+04pFT8tLMN1XoZAwrDQ54

Score
10/10
vidar973evasionstealertrojan

Malware Config

Extracted

Family

vidar

Version

39.7

Botnet

973

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    973

Targets

    • Target

      c3aaf13e00b2fa20b47d40d2a3a761e9

    • Size

      2.9MB

    • MD5

      c3aaf13e00b2fa20b47d40d2a3a761e9

    • SHA1

      a5e6edb17f2fb8b3818e70475aa644ca1589e672

    • SHA256

      e4e17547eda5ad55ec2da710928f2c766c369ef5612f73a18d5049d53dd882f4

    • SHA512

      48e9fd927ded8b2b855ac2628a05154e9fac264c1cc450ed3be33d45ca5449f17a57e81f2d8fa89cbcabf61171c1f9b53619aa9484b31ba97ed78a5f273cafbd

    • SSDEEP

      49152:CrR+n6HfwpFlN8V6Mkcj12PF1XmtBALZQynwu576ZtTBPo54:0+04pFT8tLMN1XoZAwrDQ54

    Score
    10/10
    vidar973evasionstealertrojan

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks